Improper input validation in Chrome’s Viz rendering component enables a remote attacker who has already compromised the renderer process to bypass system access restrictions by providing a crafted HTML payload. This can allow elevated privileges or unauthorized access to local resources from that web context. The impact is limited to the scope of the renderer process’s privileges, but may provide a foothold for further exploitation of the host system.

The vulnerability affects Google Chrome versions prior to 155.0.8059.39 on all platforms, as the renderer process runs with elevated privileges compared to regular web content.

The CVSS score for this flaw is 6.5, indicating a medium severity. EPSS indicates a very low probability of exploitation, with a score of less than 1%. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attacker must first have compromised the renderer process (for example via a separate vulnerability or exploiting a malicious website) before the crafted HTML can bypass system access restrictions. The attack vector is effectively remote: the attacker sends the payload to the compromised renderer, which then executes it with elevated privileges.